chore(packaging): make Flatpak metadata Flathub-ready

[thewrz]

This was written agentically; verify its assertions and edit accordingly:

Why

The Flatpak manifest still carried the former io.github.thewrz.HonkHonk identity while the generated icons already use io.github.wrzonance.HonkHonk, leaving the repository unready for Flathub submission (parent tracking issue: #84). This PR is the bounded in-repository readiness slice — no external account actions, no AUR or signed-repo work.

What

• Rename the Flatpak manifest and metainfo to io.github.wrzonance.HonkHonk and update every internal reference (manifest modules, desktop/icon install names, bundle command, flatpak.yml CI workflow).
• Complete the Flathub-required metainfo fields: screenshots, releases, and content rating.
• Verify cargo-sources.json freshness against the current lockfile (freshness gate stays green).
• Harden validation: flatpak_validate.sh gains a stale-identity guard, and a new tests/packaging/flatpak_identity_sweep.sh pins two invariants — no io.github.thewrz reference remains in active Flatpak packaging/CI, and packaging/aur/** stays byte-identical (out-of-scope protection).

Design decisions

Implemented autonomously from the issue body (no brainstorm phase). The identity sweep counts the two intentional canary literals inside flatpak_validate.sh's own guard explicitly rather than excluding the file, so a real leftover cannot hide behind the exception.

Testing

• Unit tests pass — full cargo test: 751 passed, 0 failed
• cargo fmt --check and cargo clippy --all-targets -- -D warnings clean
• flatpak_validate.sh 20/20 (includes appstreamcli validate --strict); flatpak_cargo_sources_fresh.sh clean; flatpak_identity_sweep.sh 3/3; shellcheck clean
• CI green
• Manual verification: sandboxed Flatpak build (flatpak CI triggers on tag push / workflow_dispatch only)

🤖 Co-authored by Claude Sonnet 5 (parallel-issues ultracode workflow). Closes #207.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5bd5ee3b-559a-4ecd-9247-f40a69f25749

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[thewrz]

Draft-phase adversarial review (Codex GPT-5.5, xhigh) — outcomes

Ran Codex as the draft-phase reviewer, plus an independent pass of my own. Every
finding below was verified against the actual code or executed before being
actioned — several were downgraded or declined on the evidence. CodeRabbit is
intentionally silent while this is a draft.

Fixed

#	Finding	Commit
1	apt-get step breaks the Flatpak release job. Found independently, not by Codex.	8289381
2	Icons installed one directory too shallow — theme level collapsed.	13752a3
3	Unnecessary host XDG grants in finish-args.	13752a3
4	No rename migration metadata despite the old ID having shipped.	42777ec
5	Missing metainfo copyright header.	42777ec
6	The identity sweep never ran, and could not catch drift.	51bb6dd
7	Stale thewrz project URLs in Cargo.toml and SECURITY.md.	d0c30ba

(1) The step this PR added ran apt-get inside
bilelmoussaoui/flatpak-github-actions:freedesktop-24.08, which is Fedora 41 —
it has dnf, not apt-get. I ran the real image to confirm: apt-get: command not found. Since flatpak.yml only triggers on tag push, this would have failed
the next release silently rather than showing up in PR CI. It was also
unnecessary — appstreamcli is already at /usr/bin/appstreamcli in that image,
and flatpak_validate.sh passes 20/20 there with no install step.

(2) cp -r hicolor /app/share/icons/ collapses the theme level when
/app/share/icons does not yet exist, yielding /app/share/icons/64x64/...
instead of /app/share/icons/hicolor/64x64/..., so Icon= resolves to nothing.
Reproduced both branches locally before fixing.

(3) Flatpak redirects the XDG base dirs into ~/.var/app/<app-id>/, which is
what directories::ProjectDirs resolves to in the sandbox — the app never reads
the host ~/.config/honkhonk, so those grants widened the sandbox without
changing behavior.

(4) Confirmed the old ID genuinely shipped: both 0.1.0 and
v0.1.0-alpha.1 contain io.github.thewrz.HonkHonk.yml, and both releases
carry a downloaded honkhonk.flatpak. Without <provides>/<replaces> the
rename installs as a second app and strands the old state. The metainfo is now
the one file that legitimately names the old ID, so flatpak_validate.sh no
longer greps it for absence — it parses the XML and asserts the real invariant.

(6) This was the PR's own headline deliverable and it did not work. Nothing
invoked the script, and even run by hand it only checked six hard-coded files,
silently skipping missing ones. I verified it failed to catch all three of:
reintroducing the old ID in assets/honkhonk.desktop, renaming the manifest
back to the old filename, and adding a new packaging/flatpak/ file with the
old ID. It now sweeps every tracked file's content and every tracked filename
with an explicit allowlist, treats missing files as failures, and runs on every
PR via rust.yml — deliberately with no paths: filter, since this drift can
land anywhere. All three scenarios above now fail it.

Its second invariant was also replaced. Asserting packaging/aur/** is
byte-identical to origin/main is a scope assertion about this branch, not a
durable property — committed as a permanent test it would have failed every
future PR that legitimately touches the AUR packaging.

Declined — tracked, not dropped

Four Codex [P1]s are real but are Flathub-submission concerns rather than
in-repo metadata, and each either changes the tag-triggered release pipeline or
cannot be verified without a full Flatpak build. Shipping them untested inside a
metadata PR is the wrong trade, so they are tracked in #224:

• type: dir source is rejected by the Flathub linter — but the in-repo manifest
  intentionally builds the working tree so the release job can produce the bundle.
• Hard-coded x86_64 vs Flathub's default x86_64+aarch64; the whole release
  pipeline is x86_64-only today, so this is a broader decision.
• Runtime 24.08 → 25.08, which must move together with the builder image and
  the SDK extensions.
• Screenshot URL points at mutable main. It currently 404s only because the
  file exists solely on this branch; it resolves on merge. It cannot be pinned to
  0.1.0 (the screenshot does not exist at that tag), so pin at submission time.

One [P2] is a real bug but is app runtime code, not packaging — tracked in
#225: the window sets an empty Wayland app_id, so it matches neither
StartupWMClass=honkhonk nor the Flatpak desktop ID, and shows a generic taskbar
icon. Verified in the dependency source: iced_core derives Default on
PlatformSpecific (application_id: String → "") and iced_winit passes it
straight to winit's with_name.

Heads-up, needs a human call

Codex flagged that current Flathub policy restricts AI-generated submission PRs
and AI-assisted application content. This branch's commits credit Claude. That is
a policy question for you, not something a code fix resolves — worth checking
before submitting to Flathub.

Verification

• cargo test — 751 passed, 0 failed
• cargo clippy --all-targets --all-features -- -D warnings — exit 0, no warnings
• cargo fmt -- --check — clean
• All 5 tests/packaging/*.sh pass; flatpak_validate.sh 20/20 and the
  rewritten sweep 9/9
• flatpak_validate.sh re-run inside the real Fedora builder image with no
  install step: 20/20, including appstreamcli validate --strict
• Cargo.lock untouched, so cargo-sources.json needs no regeneration

Note: the three red namcap entries are the superseded push-event run being
cancelled by aur.yml's concurrency group — by design. All three AUR jobs pass on
the live pull_request run.

🤖 Co-authored by Claude Opus 5.